I have a search that will return a number of search ids.
index=_audit | <various modifications>| table search_id
Example.. I end up with
Now for each of search_id I want to do a rest call to find out information about the search
For example, for the first search_id I want to call:
| rest services/search/jobs/1604617764.7885_5E002618-3E1F-491E-88C9-516508A9DB66 splunk_server=local
Since | rest is a generating command, I can't figure out how to do this.
You can use the map command
| map maxsearches=100 search="
| rest services/search/jobs/$search_id$ splunk_server=local
| table *
However, there are some runtime and performance limits that will affect how many ids you can run over.
Hope this helps
View solution in original post
The map command was exactly what I needed. And thanks for the correction of the services command (works with/without first /)Also, if you have other fields you want to refer to in map use $field$